Credential Protection Senior Security Analyst 1

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.

IAM Vulnerability Analyst

Today’s world is fueled by vast amounts of information. Data is more valuable than ever before. Protecting data and information systems is central to doing business, and everyone in EY Information Security has a critical role to play. Join a global team of over 950 people who collaborate to support the business of EY by protecting EY and client information assets! Our Information Security professionals enable EY to work securely and deliver secure products and services, as well as detect and quickly respond to security events as they happen. Together, the efforts of our dedicated team helps protect the EY brand and build client trust.

Within Information Security we blend risk strategy, digital identity, cyber defense, application security and technology solutions as we consider the entire security lifecycle. You will join a team of hardworking, security-focused individuals dedicated to supporting, protecting and enabling the business through innovative, secure solutions that provide speed to market and business value.

The opportunity

The Identity and Access Management (IAM) organization, a part of Information Security which, enables over 400,000 individuals across 140+ countries to access systems and information securely. As part of the IAM organization, the IAM Vulnerability Manager within PSSI will be responsible for coordinating the end-to-end vulnerability management lifecycle for vulnerabilities reported against IAM services, platforms and assets.

The role partners closely with Global Vulnerability Management, Engineering, Operations, Architecture and Service Management teams to ensure vulnerabilities are reviewed, prioritized, assigned, tracked, reported and escalated through a consistent governance model.

This position will contribute towards the execution of the IAM vulnerability management strategy through intake coordination, prioritization, ownership validation, SLA oversight, reporting, dashboarding, escalation management and continual process improvement.

We offer opportunities to develop new skills and progress your career receiving support, coaching and feedback from colleagues around the world. This role will give you an opportunity to work with some of the best talent in the industry!

This role supports various functions, including vulnerability intake, triage, asset and owner mapping, remediation tracking, service reporting, Power BI dashboarding, escalation coordination and executive visibility across the IAM vulnerability portfolio.

Your key responsibilities

Vulnerability Intake & Triage

• Receive and review vulnerability lists reported towards IAM services and assets.
• Validate vulnerability scope, affected assets, asset owners, severity and required remediation timelines.
• Sort and prioritize vulnerabilities based on severity, risk exposure, impacted service, asset criticality and SLA requirements.
• Maintain an accurate vulnerability register covering ownership, status, due dates, remediation progress and risk indicators.
• Ensure vulnerability records are complete, current and aligned with organizational standards.

Assignment & Governance

• Assign vulnerabilities to the appropriate technical groups, including Secure Access, IDM, Directory Enablement and other IAM teams as applicable.
• Coordinate with service owners and technical leads to confirm remediation ownership and delivery accountability.
• Define and maintain governance routines for vulnerability review, follow-up, escalation and closure.
• Facilitate cross-functional discussions to resolve ownership gaps, prioritization conflicts and remediation blockers.
• Ensure the vulnerability management process remains effective, repeatable and fit for purpose.

Remediation Tracking & SLA Oversight

• Track remediation progress across assigned technical teams and monitor adherence to agreed SLAs.
• Identify overdue vulnerabilities, recurring blockers, dependency risks and remediation delays requiring escalation.
• Coordinate with technical teams to obtain remediation updates, target dates, closure evidence and exception details.
• Monitor aging vulnerabilities and ensure appropriate management attention for high-risk or overdue items.
• Support closure validation by ensuring remediation evidence and status updates are documented appropriately.

Reporting, Dashboards & Visibility

• Prepare regular operational and executive-level vulnerability reports covering status, trends, SLA performance, aging, ownership and risk exposure.
• Develop and maintain Power BI dashboards to provide visibility into vulnerability remediation performance across IAM.
• Monitor vulnerability trends and identify recurring systemic issues that may require broader service improvement actions.
• Provide reporting to support audit, compliance, risk management and leadership reviews.
• Track remediation actions through to completion and highlight deviations from agreed remediation plans.

Stakeholder Management & Escalation

• Act as the primary coordination point for IAM vulnerability management within PSSI.
• Build strong relationships across Global Vulnerability Management, Engineering, Operations, Architecture, Service Management, Risk and Audit teams.
• Escalate overdue, blocked or high-risk vulnerabilities through defined management and governance channels.
• Facilitate communication between vulnerability reporting teams, technical remediation teams and leadership stakeholders.
• Promote awareness of vulnerability management expectations, ownership standards, SLA requirements and reporting processes.

Skills and attributes for success

• Good understanding of vulnerability management, cyber risk management and enterprise remediation governance.
• Experience coordinating security remediation activities across multiple technical teams and service owners.
• Analytical acumen and solution orientation to prioritize risk, identify blockers and recommend practical remediation governance actions.
• Experience developing management reporting, service metrics and process improvement actions.
• Experience building dashboards and reporting views using Power BI or similar reporting platforms.
• Build and maintain strong relationships across all levels of a matrixed, geographically and culturally dispersed organization.
• Effective communication and analysis skills to break down complex issues, formulate solutions and influence partners at various levels of the organization, including senior management.
• Possess knowledge of IT Service Management (ITSM), including Incident, Problem, Change, SLA and escalation processes.
• Good understanding of project management principles and practices.
• Experience facilitating cross-functional governance reviews and remediation status meetings.

To qualify for the role you must have

• Degree in Computer Science, Information Security or related discipline, or equivalent work experience.
• 5 - 8 years working within Information Technology, Information Security, Cybersecurity, IT Service Management or Vulnerability Management in a global firm.
• Experience coordinating enterprise vulnerability remediation activities across multiple teams.
• Experience with vulnerability reporting, remediation tracking, SLA monitoring and escalation management.
• Experience developing executive-level reporting, operational metrics and dashboards.
• Knowledge of ITSM processes and service governance practices.

Ideally, you’ll also have

• Understanding of Identity and Access Management concepts and IAM service portfolios.
• Experience supporting cyber risk, infrastructure, platform or application security remediation processes.
• Working knowledge of ServiceNow, Azure DevOps, Power BI and enterprise vulnerability management tools.
• ITIL v3 or v4 Foundation Certification.
• Understanding of NIST Cybersecurity Framework, vulnerability remediation practices and risk-based prioritization principles.
• Working knowledge of Six Sigma and Lean Principles.

What we look for

Seeking self-motivated, well-organized and detail-oriented individuals who are interested to engage and progress within a strong and dynamic team environment. Ability to work in a fast paced, rapidly changing environment with superb communication and collaboration skills would be ideal.

A self-starter, independent-thinker, curious and structured person with ambition to improve vulnerability governance, increase transparency and help technical teams remediate risk effectively.

What we offer

As part of this role, you will work in a highly coordinated, globally diverse team with the opportunity and tools to grow, develop and drive your career forward. Here, you can combine global opportunity with flexible working. The EY benefits package goes above and beyond too, focusing on your physical, emotional, financial and social well-being. Your recruiter can talk to you about the benefits available in your country. Here’s a snapshot of what we offer:

• Continuous learning: You will develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We will provide the tools and flexibility, so you can make a significant impact, your way.
• Transformative leadership: We will give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture: You will be accepted for who you are and empowered to use your voice to help others find theirs.

EY | Building a better working world

EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.